Secular Witch

The goal of a phishing scam is to convince you that something is wrong and needs your immediate attention. Scammers want you to click a link or call a phone number in order to further convince you to part with critical personal information, such as your banking details, account passwords, home address, and more. Sometimes, they'll even download malicious software onto your machine.

The thing about phishing scams is that they require you, the recipient, to take action in order to work. You've got to click that link or make that phone call for them to access your accounts. If you block, report, and delete their messages, they lose.

Most phishing scams consist of a few key elements:

An urgent, inflammatory first line or email title

An assertion of authority (support, staff, etc.)

A brief description of what allegedly needs fixing, usually having to do with account issues, payment processing, or similar

A reassurance that this can be fixed with simple steps

A link to follow or a phone number to call in order to fix the issue

A deadline

Here's a screenshot of the message I received this afternoon:

We're hitting most of the common traits of a phishing scam, minus the deadline declaration. Still, when I saw the email notification that I'd gotten this message, I felt a little panicked! I know enough about phishing scams to spot them, and I recognized this as bullshit pretty quick, but I still felt that initial jolt of fear. The scam hopes that I'll take action on that fear alone, because oh god that's my money. You know?

So, I took a breath. Told myself I'd done nothing wrong, and if it was real (which it certainly wasn't), then I could contact support and figure it out. I logged into my account to have a closer look, and... Nothing. Everything was fine. No suspension notice, no big red prompt. My payment methods are intact with no warnings attached.

Interesting, no? I took another, closer look at the message. I grabbed a screenshot of it to send to the support team since they're tracking the situation and to talk about it here.

This is a very clever phishing attempt. The message itself is well-crafted. It's a little awkward in places, but the grammar is good. My guess is it's an LLM at work, generating text to send out. The emojis are a deeply unprofessional touch that would absolutely never be included in a message about something as serious as a suspension notice. The intention is to lower your guard and make you feel as though the "support rep" messaging you is on your side. It's meant to instill trust and camaraderie.

The description of what's going on is short, sweet, and to the point. Note the urgent tone and lack of details about why this suspension has supposedly occurred. A real suspension message would typically require at least a brief explanation of the reason for suspension, often including citation of site policies or a mention of reports being filed against the account. Nothing like that here.

It goes on to threaten my money, stating that people can view my page but that any payments they make won't be processed. It raises more questions than it answers -- will people be able to make payments and their money will hang in limbo? Or will those payments not go through? Or will the site not even allow payments to be made? This is by design, meant to cause a further spiral of anxiety that will lead the recipient to following whatever instructions they've been given.

And, oh! How kind! The process to fix this is super short and easy, and they won't even need me to upload any documents. What an odd thing to say. I hadn't even considered that it would require uploading documents... such as ID, perhaps. If the process is simple and purportedly safe, there's no reason to not do it right now! This assurance is aimed to prevent the recipient from putting the task off for later. It's also meant to entice someone who's particularly panicked to not go looking for other information or solutions -- because the best one is right here, no documents upload necessary.

And finally, the link. Click here to fix everything right now, it says. But take a closer look at that link.

It starts with the "ko-fi" website name, apparently on a page called "edit profile"... at a .my address. And then, of course, a bunch of random letters. It's the .my address that should raise the biggest red flag here. Ko-Fi is a .com web address, and all of their associated pages are .com, too. While I haven't clicked this link (and will not be clicking it, thank you), it will certainly not be going to a reliable settings page.

Again, the goal of a phishing scam is to steal your information by convincing you to click suspicious links. This scam in particular seems intent on getting you to "update your information" -- that might include your banking information, PayPal login credentials, Ko-Fi account credentials, and more.

You should never have to leave the website in order to verify or update this information. This isn't just true for Ko-Fi; it's true for pretty much every single website out there.

The other big giveaway that this is a phishing scam is that message at the very bottom, stating that this DM was sent because I have commission messages turned on. Commission messages allow people to contact me by clicking a little message icon on my commission listings. This way, they can chat with me about my services before buying if they have questions or want to negotiate details.

Ko-Fi support would absolutely not need to use commission messages to reach me. Beyond that, clicking the "Support" name should take me to an account page -- but it doesn't. It redirects me to my settings page, which is what happens when someone without an account messages. The company Ko-Fi has an account.

Beyond that, Ko-Fi support operates via ZenDesk. They wouldn't send a direct message about anything, let alone a suspension notice. I would have received an email with official Ko-Fi branding.

Which... in a way, I did. When someone sends a message on Ko-Fi, it generates an email to let the account owner know they've got one waiting for response. That means that I received an email that looked like this:

By sending a direct message through the Ko-Fi system, this phishing scam was able to make it look like the message was official. This is the real reason this phishing scam is so clever. An appropriately frightened and unwary person would see this and maybe not even log into their Ko-Fi account. They might just click the link from the email and follow whatever instructions they're given.

Put all this together, and I knew with absolute certainty that this was a scam -- one that will absolutely fool a lot of people.

Steps You Can Take to be 100% Certain a Message is Phishing

Even with all this knowledge and reassurance, it can be hard to know for sure that a message is a phishing attempt. Because, like, what if? You know? What if it's actually real?

First: Take a breath. Anytime you receive a notice about any account of yours encountering issues, take a second to calm yourself. If it's real, you'll want to follow proper channels to fix it. If it's fake, you don't want to be so panicked that you fall for a scam. Either way, give yourself a moment to breathe and calm down.

Second: Check your account. Close the email or the message. Don't click any links provided. Go to the actual website or app. Log in to your account and check for any prompts, pop-ups, or warnings in your account settings. If you can't log in at all, contact the support team of the site using their preferred channel(s).

Third: Check your payment processor(s) and bank account. Make sure there aren't any prompts, pop-ups, or warnings there, too. Make sure you can still log in okay and that there aren't any suspicious transactions that have gone through or that are pending. If there are, contact support ASAP; they might be able to prevent or reverse the charge, and they might be able to block any more from that source.

Fourth: Do a quick search online. See if anyone else is already talking about it. I found several Reddit threads talking about this scam, and it seems like it's evolved slightly since it first started appearing months ago.

Fifth: Check the website's support/help resources. A lot of websites have FAQs and other resources to help users with issues they might encounter. When any scam becomes widespread, the platform will typically put out official messages talking about it. They might also have blog posts or articles dedicated to the situation. If a problem is active and ongoing, they might even put up an alert banner to both warn users who don't know about it and assure users who have gotten the message(s) to not worry. Here's the one that's splashed across the top of Ko-Fi's support page right now:

Sixth: Message support. If you can't find any information, or if you interacted with the scam and are worried about being compromised in some way, send a message to the website's support team. Use their official channels to submit a ticket, send an email, or chat with a rep. If you're pretty sure you've encountered a phishing scam and you can't find anything about it, include screenshots of the message(s) so that support can properly investigate.

Seventh: Take extra security measures. If you're still worried after all of these steps and especially if you clicked a suspicious link, change your passwords. It's important to do this for every account attached to the one that's been compromised. (In this case on Ko-Fi, if you didn't click the link from the scammer, you shouldn't need to update any passwords or anything else.)

Stay safe, folks!